That still requires going through Oura's API, which is where the second/third-party data collection happens.

I think the concern is privacy, not the user's access to the data.